Using ISO/IEC for mobile devices

Using ISO/IEC 24727 for mobile devices

Jan Eichholz,

Giesecke & Devrient GmbH

Dr. Detlef Hühnlein,

secunet Security Networks AG

Manuel Bach,

ISO/IEC 24727 for mobile devices

Agenda

ˆ

ISO/IEC 24727

ˆ

Using ISO/IEC 24727 for mobile devices

ˆ

with Mobile Signature Service

ˆ

in a Java Micro Edition environment

ISO/IEC 24727 for mobile devices

Agenda

ˆ

ISO/IEC 24727

ˆ

Using ISO/IEC 24727 for mobile devices

ˆ

with Mobile Signature Service

ˆ

in a Java Micro Edition environment

Functions of the

ISO24727-3-Interface

Card-application-service Access

Connection-service

Card-application service

ˆ

Named data service

ˆ DataSetList ˆ DataSetDelete ˆ DSIList ˆ DSICreate ˆ DSIDelete ˆ DSIRead ˆ DSIWrite ˆ

Cryptographic service

Differential-identity service

Authorization service

First ISO/IEC 24727 deployments

e.g. Australian

Drivers License

e.g. Personal

Identity Verification (PIV)

e.g. European

Citizen Card (ECC)

eCard-API-Framework

(BSI TR 03112, http://www.bsi.de/literat/tr/tr03112/index.htm)

≈ ISO/IEC 24727 + OASIS DSS (-X)

ISO/IEC 24727

(CEN 15480)

ISO/IEC 24727

(CEN 15480)

OASIS DSS (-X)

OASIS DSS (-X)

Loyal Stack

HBA

Remote Loyal Stack

(Internet Pharmacy)

eGK

Remote Loyal & ICC Stack

(Citizen Services with mEAC)

Service-Access-Layer Terminal-Layer Citizen Service Browser Service-Access-Layer Terminal-Layer

mEAC

ISO/IEC 24727 for mobile devices

Agenda

ˆ

ISO/IEC 24727

ˆ

Using ISO/IEC 24727 for mobile devices

ˆ

with Mobile Signature Service

ˆ

in a Java Micro Edition environment

Mobile Signature Service

ˆ

Specifies Web Service Interfaces between

ˆ

Application Providers (AP) and

ˆ

Mobile Signature Service Providers (MSSP)

which allow to create digital signatures with mobile devices

ˆ

Standardized by ETSI

ˆ

TR 102 203 (Business & Functional Requirements)

Mapping ISO/IEC 24727-3 to

ETSI 102204

Using the signing capability of the mobile device it is possible to design a challenge-response protocol for authentication.

MSS_SignatureReq DIDAuthenticate

DIDGet will be used to obtain information about a user profile and the status of a current transaction.

MSS_ProfileReq /

MSS_StatusReq DIDGet

The keys of the mobile users are represented as Differential-Identites (DID). Consequently the creation of a DID corresponds to the registration of a user.

MSS_RegistrationReq

DIDCreate /

DIDUpdate

Using this function the AP and the MSSP agree on security mechanisms for further requests and responses.

MSS_HandshakeReq CardApplication

StartSession

Besides path-information of regular card-applications, CardApplication Path will also return a path to the „virtual card-application“ for [ETSI-102204].

/ CardApplication Path Note [ETSI-102204] [ISO24727] Part 3

ISO/IEC 24727 for mobile devices

Agenda

ˆ

ISO/IEC 24727

ˆ

Using ISO/IEC 24727 for mobile devices

ˆ

with Mobile Signature Services

ˆ

in a Java Micro Edition environment

Java

_{Micro Edition (JME)}

ˆ

Started in Japan in 1999

ˆ

Basic Standards (MIDP 1.0 and CLDC 1.0) available

since 2000

ˆ

First MIDP cell phones available since 2000 (e.g.

Siemens SL45i)

ˆ

The Mobile Service Architecture defines a powerful

platform

ˆ

Lot’s of additional API’s (SVG, M3G, MMAPI, BT, PIM,

CHAPI, SIP, LOCATION, …)

JME Architecture

Mobile Service Architecture (MSA)

Umbrella

JSR

VM and

basic APIs

SIM access,

Crypto, PKI

XML,

WebServices

UI, pers. data,

network,

permissions,

Additional JSR’s

WS

SATSA

CHAPI

LBS

3D

SVG

PIM/FC

_Obex

BT/

WMA

MMAPI

AMS

SIP

I18N

Paymnt.

MSA Subset

MSA

Contacless

Communication

Service Connection

JSR 257

NFC, ISO/IEC

14443

communication

_{JSR 279}

enhanced Web

Services, SOAP,

REST, Atom

ISO/IEC 24727 for mobile devices

Agenda

ˆ

ISO/IEC 24727

ˆ

Using ISO/IEC 24727 for mobile devices

ˆ

with Mobile Signature Service

ˆ

in a Java Micro Edition environment

ˆ

Summary

Summary

ˆ

ISO/IEC 24727 about to become

the

global eID-standard

ˆ

MSS-based integration possible with

ˆ

arbitrary mobile devices,

ˆ

but requires additional infrastructure services (MSSP)

ˆ

JME offers the necessary functionality to integrate mobile

devices into the ISO/IEC 24727 infrastructure

ˆ

NFC will push forward to integrate contactless

communications into mobile devices

Deadline:

15.05.2008

Call for Papers - BIOSIG 2008

Biometric Border Control & Federated

Identity Management

September 11/12, 2008, Darmstadt

Thank you very much

for your kind attention!

Contact:

Dr. Detlef Hühnlein

secunet Security Networks AG

[email protected]